Astro, define:vars XSS Injection, CVE(Not disclosed) (Critical)

The vulnerability exists in Astro’s `defineScriptVars` function (packages/astro/src/runtime/server/render/util.ts lines 42-53). It sanitizes values injected into inline `` (no `i` flag), whitespace before `>` like `` (the tokenizer enters “before attribute name” state), and self‑closing slash like `` (self‑closing start tag state). `JSON.stringify()` does not escape <, >, or `/` characters, so malicious input passes through unchanged. The execution flow: user‑controlled input (e.g., Astro.url.searchParams) → assigned to a variable → passed via `define:vars` on a `

Listen to this Post